When AI Makes the Purchase, Mastercard Wants Proof

Mastercard recently announced the launch of “Verifiable Intent,” a program that will allow banks to determine whether a transaction performed by an AI agent was conducted with the authorization of the cardholder.

As artificial intelligence begins to influence how shoppers buy items online, analysts believe the use of AI in e-commerce may lead to trillions of dollars in retail sales in the decade ahead. Visa and Mastercard control over 70% of global purchase volume outside China.

As digital assistants begin researching and purchasing products for consumers, banks will need a way to determine whether an AI agent is acting with its owner’s authorization. Google states that in AI shopping environments, “User intent must remain clear, provable, and protected.”

This move is reflective of a larger movement by payment networks to prepare themselves for what analysts have dubbed “agentic commerce,” in which AI systems conduct transactions on behalf of users.

Mastercard Chief Product Officer Jorn Lambert told The Globe and Mail that “agents have the potential to enable a much more seamless shopping experience, but this will only be possible if the agent can be trusted and if merchants have the tools they need to support this new era of commerce.”

Card payment structures are well-established, with consumers initiating purchases, merchants submitting those transactions, and then the various networks submitting them to the appropriate issuing bank(s) to obtain approval for a transaction.

There are now new participants in this process: artificial intelligence agents such as automated assistants that can search for products, compare prices, make purchases, and complete checkout on behalf of a consumer.

Mastercard introduced the “Verifiable Intent” framework to create a cryptographically verifiable record of an individual’s intent to authorize a transaction that will be made possible through the use of an artificial intelligence agent.

This allows consumers to link their instructions to the actual transaction in which the AI is engaged, thus enabling banks, merchants and other parties to verify that the AI agent has acted within the bounds of its intended purpose as instructed by the consumer.

This additional layer of participation creates uncertainties regarding the consumer’s intent to conduct a transaction. Issuers will need to verify not only that the cardholder is legitimate, but also that the AI agent followed the cardholder’s authorization to complete the transaction.

In addition, Mastercard says the technology creates a tamper-resistant record that can support dispute resolution if questions arise about how an AI-initiated transaction was completed.

If many of an issuer’s (or merchant’s) online purchases were to be executed by AI agents, then those issuers and merchants will likely have to modify their present payment systems.

New signals, which relate to whether an AI Agent authorized a transaction, may be added to the fraud detection and/or authorization models employed by banks for all transactions authorized by AI agents.

Additionally, merchant platforms may need to recognize the existence of credentials that verify that an AI Agent was authorized to execute a transaction on behalf of its owner.

As commerce becomes increasingly digitalized, these modifications would represent yet another improvement in the security of payments.

The Verifiable Intent framework is designed to address that problem. It allows an authenticated record to be generated and recorded as a cryptographically verifiable record of the consumer’s approval of the transaction.

The process creates a link between the consumer’s instruction of the transaction to the ultimate execution of the transaction so banks, merchants and networks can verify that the AI agent acted in accordance with the parameters approved by the consumer.

By making Verifiable Intent available, Mastercard is essentially taking steps toward defining the nature of trust and authentication where it relates to machine-based (as opposed to human-based), completed purchases.